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1 . 


INTRODUCTION AND SUMMARY 


t A significant number of Space Transportation System (STS) 
missions will require that payloads be placed in high energy 
orbits which cannot be achieved using the Space Shuttle alone. 

The Department of Defense (DOD) is developing an Inertial Upper 
Stage (IUS) System to fulfill both NASA and DOD requirements for 
such missions.- The IUS will extend the STS operating regime to 
include higher orbits, orbital plane changes., geosynchronous 
orbits, and interplanetary trajectories. 

DOD has contracted with The Boeing Company to complete full- 
scale development of an expendable solid propellant. IUS System 
that will satisfy both the NASA and DOD requirements. Marshall 
Space Flight Center (MSFC) is designated the NASA Center 
responsible for IUS Project Management and coordination activities 
during IUS development. This . responsibility includes the definition 
of NASA-unique mission requirements and analysis to ensure that 
these requirements are properly implemented. Figure 1-1. shows the 
relationship among the major IUS milestones and the Boeing schedule 
for developing the IUS software. 

Under a previous contract (see Reference 1) M&S Computing, 

Inc., defined. NASA-unique flight software requirements, evaluated 
the IUS software preliminary design, analyzed the IUS software 
interfaces with other systems., and defined a cost-effective, level 
for NASA participation in software verification. This report 
des 1 "" ibes a continuation of the above effort to analyze the IUS 
software. 

1 • 1 Study Objectives 


The objectives of this study were to provide the engineering 
and data management system -analysis necessary to evaluate, the 
detailed design of the IUS software. This effort also was to 
ensure that the IUS fulfills NASA mission requirements and 
integrates successfully with the Space Transportation System 
{ STS ) • 


1.2 Scope 

Four primary tasks were performed during, this contract: 

1. Design Analysis. 

2. Validation Requirements Analysis — 

3. Interface Analysis. 

4. Requirements Analysis. 

Figure 1-2 shows these four tasks and how they interact with the 
Boeing software development effort for the IUS flight software. 

The scope of each tas/: is described in more detail "in the following 
paragraphs. 
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1.2.1 Software Detailed Design Analysis 

The detailed design of the IUS flight software presented in the 
Type C5 Computer Program Product Specification (CPPS) was analyzed 
and evaluated for compliance with the NASA requirements identified 
in the Type B5 Computer Program Development Specification (CPDS) . 
Analyses included active support for -technical interchange (TI) 
meetings, software working group meetings, the Two-Stage Critical 
Design Review (CDR) , and other meetings with SAMSO, Boeing, TRW, 
and Martin Marietta. Performance -of the task also included 
evaluating other applicable software documentation. Periodic 
deliveries of software schedules showing the Boeing activities, 
the TRW activities, and the M&S Computing activities were accompli shed . 

1.2.2 Software Test Requirements 

Software test plans from -Boeing and TRW were evaluated in 
preparation, for the Two— Stage. System CDR and Software CDR, respectively - 
Further definition of the NASA-unique test requirements was post- 
poned until Boeing provides greater detail in the Type. B5 NASA 
Addendum and until the NASA PDR which has been tentatively re- 
scheduled for August 1979, 

1^2-. 3 Interface. Analysis and Def inition 

Current design and proposed changes, to. the spacecraft and 
third stage interfaces were analyzed for impact on. NASA missions 
and payloads. Specific requirements for the_NASA communications 
net were also evaluated. 

1.2.4 Software Requirements 

Each release of the DOD/STS CPDS and the NASA Addendum were 
evaluated to determine whether NASA-unique requirements were - 
included, modified, or affected. New. requirements and an explicit 
restatement of established NASA requi reme nts were delivered as each 
new release was evaluated. 

1 . 3 Software Analysis Overview 

An overview of the IUS software analysis activities is shown 
in Figure 1-3 with emphasis in two software areas: Support Soft- 

ware and Operational Flight Software (OFS) . 

The major areas of emphasis were the OFS requirements (CPDS) 
and design (CPPS) analysis. Figure 1-4 depicts the events 
associated with each of the four major M&S Commuting tasks. The 
scheduled events primarily represent analysis activities documented 
in the IUS memoranda listed in Appendix A. 
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Requirements evaluation activites are summarized in Section 2 
with an updated status for the NASA-unique requirements. Section_3_ 
identifies the analyses associated with technical interchanges on 
the preliminary DOD/STS software design and the results of a 
review of the CPPS for the DOD/STS Software CDR. Analyses 
associated with the software test documentation. is presented in 
Section 4. A discussion of communications and spacecraft inter.- 
face evaluation work is found in. Section 5. Prom these basics, a 
set of conclusions concerning the NASA IUS Software development 
is presented in Section 6 along with accompanying recommendations 

for further analyses and evaluation. Appendices B and C provide 

additional background information on guidance, navigation,, and 
control, and on planning documentation and support software analysis, 
respectively. _ 


2 . 


SOFTWARE REQUIREMENTS EVALUATION 


The IUS DOD/STS flight software requirements have undergone 
a major transition during this .contract period. In Table 2-*l 
the first column-indicates the four CPDS versions evaluated 
during the year, and the third column presents the corresponding 
M&S Computing's evaluation reference. Revision E was rewritten 
by the Software Working Group and then baselined as Revision G. 

The NASA Addendum to the CPDS, however, has remained stag- 
nant since the initial release on July 28, 1978. A draft rewrite 
designated Revision-H was released in April 1979. This version, 
improved some areas and degraded other areas. For example, a NASA 
data- description section was added (data items incomplete) ; howeven, 
a major section on spinup requirements was replaced with, a To Be 
Supplied (TBS) and the Communication section -restricts a mission to 
use either the Tracking and. Data Relay Satellite System (TDRSS) or 
the Spaceflight Tracking and Data -Network (STD '■) , but not both, during 
the same .mission. The NASA-unique requirements are still in the 
preliminary stages of definition. 

NASA-unique requirements stem from three sources : 

• Guidance Navigation and Control (GN&C) requirements 
for planetary missions. 

• NASA-unique communication requirements. 

• —NASA-unique IUS three-stage configuration. 

A summary of -the NASA requirements previously identified is 
presented in Table 2-2. These requirements were evaluated against 
Revision G of. the CPDS and the Revision E NASA Addendum to deter- 
mine the implementation status. Table 2-3 presents a cross- 
reference matrix between the NASA-unique requirements identified 
by M&S Computing (Reference 8) and the pertinent (or related) 
sections of the basic CPDS, Revision G, and the NASA Addendum. 

A description of the CPDS section content is also included for an 
easy reference. NASA-unique requirements are discussed in the 
following overview, paragraph 2.1. Boeing's evaluations of these 
NASA functional requirements are presented in paragraph 2.2 along 
with an M&S Computing assessment of current requirement status. 

2 . 1 Overview 

Derived requirements for the Executive and Mission Sequencing 
functions have a relatively minor impact on IUS flight software. 

No NASA-unique flight software requirements have been identified 
for the navigation function. Although the utilization of the 
navigation software function is unique for NASA planetary missions, 
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IUS SOFTWARE REQUIREMENTS 


EVALUATIONS 


DOD/STS 
CPDS VERSION 


NASA 

ADDENDUM 

VERSION 


REFERENCE 


January 13, 1978 , 

8 


September 15, 1978 
(Procurement Specifica- 
tion, Revision F) 


July ,28 , 1978 
Revision E 


9, 10 


October 15, 1973 
(CPDS, Revision F) 


July 28, 1978 


11 / 12 


December 1 , 1978 
(CPDS, Revision G) 


July 28 . 1978 


Table 2-2 
(This report) 


March 23, 1979 
(Revision h, Draft) 


Section 2 
(This report) 


Table 2-1 
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NASA-UNIQUE FLIGHT SOFTWARE 
REQUIREMENTS summary 


Software Function 
• Executive 


Mission Sequencing 


•- Navigation 


• Guidance 


* Attitude Control 


Communications 

Redundancy Management 
Checkout 


Requirements 

™ Vid 5 1/0 contro1 and formatting of 

i° thS SCU for 'Section of 
tne NASA transponder mode (TDRSS 

or STDN) and NASA antenna switching. 

?5° V i de se f uence control .and timing 
functions for planetary missions to 

JXfSr ^ C0 ^ d and third sta ^ e ignition 
timing, . third stage spinup, and 

separation of the second stage. 

D0 ?. has incorporated essential 

fo] f P° sit i°n and attitute 
state initialization and updates. . . 

Calcuiate on-pad and on-orbit launch 
window targeting parameters for 
planetary missions, including 

to * aunch opportunities, 

to meet planetary injection accuracy 
requirements . y 

Provide the capability to spinup the 
second stage/ third stage/spacecraft 

TBD r P m under active 
control while maintaining the 

” e F^ :Lal orient etion of' the spin axis 
within specified limits. 

Provide autonomous control .of IUS/ 

?tnn» anb J5? na w Switching for -& ccmmunica- 
Wlth th f 0rblfc er, a selected 
TDRS, or a selected STDN ground station. 

Maintain an antenna status flag as 
set by ground command for each of 
20 IUS/NASA antennas. 

No NASA-unique requirements identified. 


Table 2-2 


- 11 - 


-ASA- UNIQUE SOFTWARE REQUIREMENTS 
I implementation STATUS' 



Table 




NASA -UNIQUE SOFTWARE REQUIREMENTS 






M 


Table 2-3 
(Continued) 


NASA- UNIQUE SOFTWARE REQUIREMENTS 
IMPLEMENTATION STATUS 



Table 2-3 
(Continued) 






NASA-UNIQUE SOFTWARE REQUIREMENTS 
IMPLEMENTATION STATUS' 



Table 2-3 
(Continued) 




NASA- UNIQUE SOFTWARE REQUIREMENTS 
IMPLEMENTATION STATUS 



Table 2-3 
l Continued) 






UNIQUE SOFTWARE REQUIREMENTS 
IMPLEMENTATION STATUS 



Table 2-3 
(Continued) 








NASA-UNIQUE SOFTWARE REQUIREMENTS 
IMPLEMENTATION STATUS 





- 19 - 


ro -c 
i <u 
N 3 
<0 .2 
JQ C 

m o 
H O 



* 




NASA -UNIQUE SOFTWARE REQUIREMENTS 
IMPLEMENTATION STATUS 







A 


Table 2-3 
(Continued) 



NASA-UNIQUE SOFTWARE REQUIREMENTS 



Table 2-3 
(Continued) 





* 22 - 



DOD has incorporated the essential capabilities for initialization 
and update of the position and attitude state. Areas of concern - 

pertaining to the_quidance software-function ..are included in 

Section 2.3. 

NASA-unique attitude control requirements. are associated with 
stabilization and spinup of the third stage. Some details of the 
attitude control requirements are to be determined from planetary 
injection accuracy analyses, including spin-stage dynamic per- 
formance. Definition of the following attitude control require- 
ments are dependent on completion of these analyses: 

• Attitude and attitude rate limits for the inertial 
attitude at start of spinup. 

# Spinup under closed loop control. 

Attitude and attitude rate limits for pitc h and 
yaw. 

Spin_rate at which spinup under closed-loop control 
will be terminated. 

* Definition of a verified attitude control law for 
spinup . 

* Tolerance on final spin rate. 

The diet Propulsion Laboratory (JPL) requirements for the IUS 
planetary mission accuracies from the IUS System Specification 
of March. 17 1978 , are presented in paragrah B.3. of Appendix_5. 

The appendix also includes a .detailed description of JPL'_s 
approach to meeting injection accuracies by calculation of a 
Figure Of Merit (based on a statistical .measure of the spacecraft 
velocity requirements at midcourse) to control removal of IUS 
injection errors. 

NASA-unique communications requirements have been defined 
for autonomous antenna switching. The antenna switching algo- 
rithm is based on the geometry of the IUS position, IUS attitude 
(and antenna configuration), Orbiter position, and positions of 
the TDRSS satellites and STDN ground stations. For NASA three- 
stage IUS missions, communications requirements after start of 
spinup are still an area of concern as discussed below. 

Currently, the IUS System Specification (SS) and baseline 
design make no provisions for downlink of the second stage ^ 

telemetry stream after initiation of "spinning stage operation.’’ 
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:£/F ar? r h V! 

° f third ® ta ?e dynamic, performance (includina spinup 9 
Prit ItT the 

3. 1.5. 2. 7 Telemetry 

The IUS shall be capable of transmitting to the 
ground: (1) state vector and attitude data 

immediately prior to spacecraft/IUS separation, 

(2) verification of XUS vehicle to spacecraft 
separation events, and (3). verification of 
received commands. 

F°f. thre ®-stage missions under current IUS/SS requirements the 
iff? to downlink -the IUS state vecto? and vehicle 

attitude will be 3 ust prior to start of third stage spinup. 

(w\ recommended that the .second stage radio frequency 

t( em , re ™ ain active during third stage spinup as lonc/as 
the IUS attitude reference is available to support P autonomous 
sw rtching. With an adequate software -capability for 

s ^ tchl J g/ u secon d stage RF communications can be maintained 
at least through the active attitude control phase -of -third staae 
spinup. This additional telemetry will provide data ^or a 
critical to successful third stage performance Peri ° d 

... The major. NASA impact, on redundancy management software is 

*i ntenanCe ° f Status fla ^ s the NASA antennas. No specific 
f e< 2uirements have been identified which affect the 
checkout software function. However, a ootential source 

required U to q aupport^any/ NASA-unique^tests^^commo^DOD/ST^IUS 

The following items are recommended for further study: 

• Formal^ coordination of NASA-unique software require- 
ments within the NASA/ IUS community orior to incor- 
poration in the Type B5 specification (CPDS) . 

• Thorough planetary injection accuracy analysis (including 

spin stage dynamic performance) to support- detailed 
definition of guidance and attitude control require- 
ments for three-stage missions. H 
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• Coordination and definition of a firm timeline for 
communications requirements during NASA missions 
including third stage spinup and the resulting impact 
on the antenna switching algorithm. 

• Continued analysis of IUS flight software development 

activities and products to ensure that NASA-unique 

requirements are met. 

2.2 NASA-unique Functional Requirements 


The NASA requirements for the eight baseline software 
functions defined in Table 2-2 are driven by requirements from 
IUS-STS-100, Volume 3, and Volume 3-1 (see Reference 14) . NASA- 
unique IUS -flight software requirements, are either directly driven 
by the IUS/SS, Volume 3-1, or derived from its provisions. 

The state of the NASA-unique requirements to be incorporated 
in Revision H of the NASA Addendum (Reference 13) is detailed in 
the following subparagraphs and related tables. There is a sub- 
paragraph for each of the eight baseline software functions. The 
related tables contain the NASA-unique requirements as originally 
described in Reference 1, the source paragraphs from IUS-STS-100 
(Reference 14)., and the present status defined by Boeing in 
Reference 15. 


2.2.1 Executive 

The .executive software, function must provide proper manage- 
ment of the NASA-unique software requirements contained in other 
software functions. At the present time, the executive function 
capability required by and planned for DOD missions supports NASA 
requirements with one exception. This exception is- related to the. 
communications subsystem which must provide compatibility with 
STDN ground stations and the TDRSS . 

NASA-unique software requirements for the executive function 
are presented in Table 2-4. The required commands to the Signal 
Conditioner -Unit (SCU) will be determined by the executive from 
outputs of the command processing and autonomous antenna- switching 
subfunctions of the communication software. In Reference 15 Boeing 
states that the_present transponder system does not distinguish 
between STDN or TDRSS stations and that a change will be included 
in the NASA Addendum revision of September 1, 1979. To support the 
August 1979 Preliminary Design Review (PDR) , an Advance Documentation 
Revision Notice (ADRN) is needed to document this requirement. The 
other present-status items are acceptable. 
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Table 2-4 


2.2.2 Mission Sequencing 

Utilization of the mission sequencing software for NASA 
planetary missions will be impacted by the longer duration of 
the three-stage missions, and by launch, window and multiple on- 
orbit injection opportunity requirements. This impact will result 
in increased si 2 e of the event tabic (additional attitude and rate 
maneuvers, additional navigation updates, etc.) and may result in 
increased use of the real-time command capability for sequence 
changes. The resulting software requirements are presented in 
Table 2-5. These requirements are derived from guidance, attitude 
control and communications software function s, and third stage 
inter fac e requirements. 

Boeing states that the mission sequence table is constructed 
to provide the separation of the second stage after spinup; however, 
the third-stage spinup sequencing requirements still reference 
third-stage avionics operations. This section will require an 
update when the changes identified in ECP 247 are implemented to remove 
the third-stage avionics. 

2.2.3. Guidance 

The requirements to support interplanetary missions are, of 
course, NASA-unique. . For these missions, it is necessary to target 
to a specific hyperbolic- escape velocity, V» , rather than to an 
orbital period as in the geosynchronous missions. Computation of. 
the hyperbolic, escape velocity is dependent on the relative motion 
of the target planet. The guidance scheme must also permit targeting 
on successive orbital opportunities without memory update. 

The NASA-unique software requirements for guidance and target- 
ing are presented in Table 2-6. Since the interplanetary injection 
accuracies are not explicitly defined, the permissible variations 
in the constraining vector could not be bounded in the software 
computations. 

Boeing states that the planned guidance update in Revision. 

H of the DOD/STS CPDS provides for on-pad and on-orbit launch 
window targeting parameters; however, this dees not answer the 
question of delay time accommodation: specifically, how well the 
STS-100 (Volume 1) requirement for retargeting to a dissimilar 
mission within two hours of launch can be handled. At the DOD/STS 
Two-Stage System CDR (Reference 16), Boeing deferred applying the 
Revision H retargeting requirements to planetary missions until 
further analysis is completed. This leaves the targeting parameters 
for multiple on-orbit launch opportunities undefined. Finally, 

Boeing states that planetary accuracy requirements identified in 
EC? 247 shall be determined during NASA certification .- 

A detailed discussion on guidance is presented in Appendix 3. 
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Table 2-5 


GUIDANCE 

BOEING STATUS 

| LINE NO. I US- 100 PARA . I US FLIGHT SOFTWARE REQUIREMENTS (CPDS PARA.) 
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2.2.4 


Attitude Control 


Ui T*H 2ation of the attitude control software is affected by 
NASA missions in three ways. First, the use of directional 
antennas for NASA RF communications may call for additional 
attitude changes to maintain communications. Second, the three- 
slons < r a11 for additional attitude and roll maneuvers., 

The third area is also related to the three-stage missions and 

inn?^ VSS f? innin ? the entire second stage/third stage/spacecraft 
configuration using the IUS Reaction Control Subsystem (RCS) . 
Existing DOD software will support the first case if autonomous 
maneuver capability were enabled. The second area is fully 
supported by DOD software and the third has unique requirements 
as defined in Table 2-7. 

ref i e ?? s th e Boeing statement that the attitude 
control software shall provide the capability to spinup the -- 

at JL f d r f^ ag j{ Spac ® craft configuration with gyro saturation occurring 
a *J f ? I th ? r ® 13 n ? mention of the 70 rpm requirement. A requirt 
t0 termi *?? te a Pmup at .a desired rpm would be preferable to 
c ° rt ™ andln 9 the roll, thrusters full .on until RCS is depleted. 
For the latter case, the spin rate would not be predictable. 

ff? l i r S men 5 s also state that spinup shall be in the fixed 
h tl ? e v IUS software. The NASA Addendum, Revision 

H replaces this mode with a TBS leaving this requirement undefined 

D^ior e S ;L fn^ nt t ^ ate tbat active control shall be terminated 
88 ° f thS attlbude reference;- -however, .RCS pitch and 
r a * J^rusters are not positively inhibited prior to. loss of the 

LiSe No ??CTcf T “Eu 2 “?! “ aPPrOXtmatel1, 5 rpm <refer « 

2.2.5 Communications: Antenna Control Function 

To provide the required TDRSS compatibility, the NASA RF 
communications baseline uses ten directional antennas for spherical 

imnl^m^fS ther t ? an the tWO 0innis used D0D * Although DOD has 
implemented an autonomous antenna switching capability NASA 

requirements for autonomous antenna switching are unique* in two 
respects: 

• The large number of antennas (with narrower beamwidth) 
demands more frequent antenna switching to maintain 
spherical coverage as the IUS translates and rotates. 

• Autonomous selection of a communication link must 
consider the two- TDRSS satellites and five STDN 
ground stations instead of the Air Force Space Ground 
Link— System (SGLS) ground stations. 

Table 2-8 presents the NASA-unique software requirements for 
autonomous antenna control. 4 ts Ior 


- 30 - 


<* 1 


m 

=3 

t— 

«C 


1— 

l/l 

«c 

OC 

UJ 

< 

o. 

z 

LU 

m 

Q 

CL. 

o 

O 

03 

■— 


IT) 

4U 

• 

*»“ CO 

CM 

5 O 

* 

U 

00 


A 

•r- C 

00 

(— O 

« 

■1- •!— 

CM 

£ M 

• — 

ro <0 

CM 

Q.XJ e 
(O (O Q. 

CM 

U S- i. 

• 

en 

oo 

w at in 

•<- XJ 

A - 

£ M 

»— 

M C (O 

• 

o 

CM^ 

»/> ••— at 


0) M M 

CM -• 

“0(0(0 

• LO 

•f- Cl J- 

CM * 

> •<- 3 

• CM 

O > M 

CO • 

S- (O ro 

— 'OO 

o. e w 


— - -. 



at £. 


MBBBi 



"C l. 

at •*- - 

■a 




£ > 1 Q 

at oi 

" 



(J OON 

at c s- at m 




5- i. 

C-c OO •(- 


f 


«- CL"r- o 

M £J*- 3 Q S 


— t 

00 

C £ M 

£ M CD •«- 


w 

H- 

O ■— M 

c at aj •(- t— <— 


os 

z: 

•(— r“ C 

•r-> M L. +J 



LU 

m to a» o 

0) (O M S *C 

- 

s—\ 

2Z 

(O £ £ ■*- 

O O 3 15 ■!• C 



LU 

i_ |/1 M M 

at m £ ro 


u 

a: 

(O ro. 

M tiv l/l M £ 


1 J 1 


Cl- 0) CL i~ 

(0 “O O *r— ‘f™ “3 



ID 

HI L 3 3 

■r 3 IZI £ J (Q 


u 

Z3 

O' 

LU 

l/l rO 31 

2 c M- 

m m i— at 
•i- — at to -a 


H" 

OC 

OIU'rlL 

c m o at 




o<+- a. c 

‘i— m e • c at 



LU 

<o o w o 

<0 tO C-'<- M 


_r* 

OC 

■MW O 

at *o u to to 



< 

l/l O 

£ <— — 3 M U 

'5*. 


s 

1 1— M M 

(O 3 £ C' 




"O O <4- 

(— •— £ *r- "O 



Uu 

C L >,« 

(— m at ro c 



o 

O M M i. 

a Li/i oe a 

. 


oo 

(J- C — U 

£ O => <0 




QJ Q r- <1? 

t/i c i-h m aj at 

~ 


1— 

U) U<r U 

■f- l/l £ "O 





a. at i 3 



CD 

s id m a 

3 XQ £ T3 r— M 



♦— » 

m -a a. w 

c at m i_ i— •— 



— J 

3 (0 * 

•i- :< — - ro M- 

■ 


Ll. 

L *J U HI N 

CLt- >,£ £ M 




O •— C3 Q 

l/t M £ M l/l ro 



00 

•1— M at (O CS 





i. J-> £ M-H* 


I. 



C_ O M </l + | 

• 




at e 

£ o at r— 

Ml. > r— 

m at t. to 

co O' 

•l— -r- C 
CL > ■>“ 
LO C s 
5- O 

O 1 


W M M £ 

M Q.(— 

(— S- £ M 


IQOJ IQUM 

ro r— 

O >)M M • O 


(-S.ro at 

w ■(— O 

S--M C -r- 3: C 


Cl£ i— £ 

i— M- 

m *r- a 2 ns 


91 C IQr- L OM 

i — ro 

c r- U >, W 


£ O (— ro 01 L.- 

o £ at 

£_ l/l £ 

O *i- C -r— 


r— •(- U *3 M 0- 

o £ -a o -o 


(— (O c c o 

M M 

«J C ‘r C 41 


(— </1 > M 3 O 

c at 

<U M (0 M ro Xt 


ro «_(0 O u in 

O 1- M 

"O l/l (0 3 


£ (Q X V) 

u ro C- 

3 C M £ M 


in— - in i- at at o 

3 at 

m at o c o ■> — 

Q.-»- Q. > > r- 

0) M E 

•r— ”3 * 1 — at M M 


1—3 at -r- 

> a- at 

M-t- M->i— •#— +J 


o c at e — -m o 

o r— 

M > •»- J_ Q. ro 


S. I- U 3 £ O M 

4->- t/l O. 

(0 O XJ o 


M a. C £ U <- 

u S 

i- C C r— 


c w at ><“ ro t- • 

^ OJ 

at a. o L. -r- r— 


o s- x o at 


£ U O O 


o ci at to at • <i— o 

4- +J O 

M <— M (/! s- 


C «M E £ /— S- C 

O- 4U 

<— o u at 


at -r- at oat) 

* 

- <o c at at at 

« 

-o s- s_ at f— s- s. 

C — N >v 

CL£ •(- > i- £ 

4-> 

3 3 £ <— M -o at 

O = 

3 l/l C C1M 

c 

m -o at i— ro c at a— 

•i* CL.*r^ 

c c c at 

a; 

•(“ XJ £ o m at 

+-> U *— 

•I— t/l r- O L- 


M T3 3 W U ro L. 

fD *f“ 

Q. = £ Cl O 

<u 

M OJ M . — 

C O ^3 

t/l £ l/l l/l O 

L. 

ro c •— ro £ at •— at 

( PfS (tj 

M Q3 r— 


■— M +J Q.T3 £ X3 

■p VI £ 

m ty 

we at at o 

2 

4)iQ(tiQL3L 3 

C i- £-£ , L. 

CT 

> M- (0 T3 M at M 

<U i/> u 

■<- O M M + |M 

<U 

■- C O — M -r- 

a; 

1 - Cl c 

s- 

m-t- <n 3) r- m 

OJ 

3 >— C M S O 


u iq c i; m at m 

4-j rn _c 

C (0 •«- o ■<- OJ 

<0 

< £ — — vl ro-£ in 



I 

CM 

0) 

3 

r0 


* 


< 

C£ 

< 

O- 

o 

o 


I 

r/1 


LO 


CO % 

in 


Cm 

co 



-ji 


i 

-O 


I 

n 


fsj 


i 

n 


co 

t 

to 


- 31 - 


i 

n 


rmwi'Fl' 




CO 

© 

h- 

< 


1— 

CO 

< 

Ct£ 

© 

< 

ta- 

>-t 

co 

LU 

© 

© 

Cu 

© 

ca 



U*> 

CM 

m 

c 

o 

‘r- 

4-> 

0 

01 

(/I 


■o 

01 

V) 

to 

0) 

s_ 

■o 

"O 

<Q 


to 

01 

o- t. 

c 

O 3 

o 


•t— - 

0> <0 


to 0 ) 

o • 

3 4- 

<U LO 

>>4-10)' 

to • 

CM 

©CO 

c * 

tu c 

<r» 00 

•o > 01 

•o .« 

3 0) 3 

> o* 

oi ro 

O) C 01 

to I— 

■r— O to 

to • 

■c 1 

0) CM 

o 3 c 

4. . 

— - (Q Q O 

*o ro 

^ r“ *i^ — 

T3 • 

♦ V* 

tO CM 

Cm O vi 

• 

* H- *r— 

£ CM 

CM iA S 

<U • 

* »f— <l) 

+-> CO 

n r r h- 


o 


O 

a 

i— «— 
X Q 
O LU 
<-> 3 


Q (- 

h- o 

— o 


CO 


©1 

lU 

ec 


cc 


© 

co 


X 

© 


to 

© 


o 

C£ 


o 

o 


o 

<_) 


3 

to 

>0 

-o 

c 

<o 


u 

+J 

Q. 

<«- 

o 

e 

o 

■r— 

4-» 

IQ 

4— 

<11 

C. • 

O to 

s- 

4-> oi 
•r— tJ 

-0 to 
3- 
-C S- 
C X 


W 

c 

‘I- c 

c f- 
t- Q.. 
J- to to 
O E 

"" t 8. 

c u 

O QJ 
-CO 
<— 4J r- 

3 0) <U 
<4- X3 J= 
■I- 4-1 
to > 
i- 0 -0 
<u s- > 


<u 


■o 

<u 


c 

a> 


Cl 

£ 


4J a 3 


<u 

to 't— 


£ 3 

3 i— JZ 


• 

4.-1 — o 


r— CL 

-c *r- to 


f— r 

+4 3 


03 C 

o 


-C -f- 

r— X -4-1 


(/I Q. 

r*»- (J 


t/) 

O-i-O 


4-» 

s — c o> 


•r- <4. 

3 i 


.O C 

*o o 


>r^* 

C 0) +-> 


-c c 

S S ■ 

« 

£= O 

g ■>- 3 

OJ 

•p* 

£ +J -u> 

4-> 

+J 

O IQ 

tX3 

</> OJ 

U. «3 L 

U 

f— 

CC CL 


u 


t£ 

oc] 

< 

a. 

o 

© 

i 

H- 

LO 


o 

2? 

LU 


CM 


I 

LO 


LO 


1 

-n 


*32- 


Table 2-7 


COMMUNICATIONS: ANTENNA CONTROL FUNCTION 
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Table 2-8 
(Continued) 


The NASA-unique requirements specify an automatic mode 
selection algorithm that will autonomously select the best 
communications link from the available choices: five Space- 

flight Tracking and Data Network (STDN) stations, two Tracking 
and Data Relay Satellite (TDRS) stations, or the Orbiter. The 
current status of the Boeing design provides only a manual mode 
selection capability through an uplink command,, i.e., without 
established communications, the mode cannot be switched. 

A more severe problem, however, is the lack of any design, 
provision to include the TDRSS communications link. The Boeing 
status proposes loading the TDRSS coordinates in the table 
reserved for ground stations on a DOD mission. This solution 
does not allow .loading the STDN coordinates into the flight 
software. for the. specified mission. In other words, TDRSS and 
STDN are mutually exclusive and cannot be used on the same 
mission. This solution is not acceptable to MSFC and does not 
meet the requirements of STs-100, Volume 3-1, Sections 3.1.5. 2.7 
and 3,1. 5,3,6. 

The requirement to select the communication link in a. manner 
which maximizes command, uplink signal strength at the antenna 
will not be implemented. This algorithm would result is pre- 
dominate selection of STDN ground stations (whenever available) 
instead of the TDRSS which is the preferred link. 

NASA.-unique requirements, to compensate for spacecraft 
occultation are also not provided by Boeing's software design. 

In a telecon Boeing personnel stated that the current design 
provides an acceptable ninety percent telemetry coverage and 
that provisions for occultation have never been established as 
firm requirements. 

Requirements associated, with maintaining communications 
during spir.up are not met with the status defined by Boeing. 
Antenna switching is supported up ta a rotational rate of five 
dsgrees per second, which is less than 1 rpm, so there is no 
capability to continue communications throughout spinup. There 
is an inconsistency in the Boeing status regarding dropout of 
telemetry (TLM) during antenna switching. Line No. 6-1.3 
indicates.a 5-second loss of TLM but Line 6-1.5 states that 
switching is make-before- breaks A clarification of status is 
needed - our understanding is that there is a short loss of TLM 
signal during antenna switching. 

Current implementation of the manual (uplink) override of 
antenna selection provides a short-term override of 30 seconds 
with an automatic return to autonomous selection processing. 

This design accomplishes the intent of an override command. If 
a longer override period is desired, successive override commards 
may be issued . 
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A detailed discussion of communication interface limitations 
that may result in a loss of telemetry is presented in paragraph 
5,1. 


2.2.6 Redundancy Management 

The Boeing design status in Table 2-9 fails to provide redun- 
dancy management for the antennas or. the STDN/TDRSS stations. If 
a bad antenna or station is selected, the -IUS telemetry is lost 
until another switch occurs to a good communications link. Uplink 
commands could easily remove failed links and antennas from 

consideration. An antenna failure would have to be uplinked 

after the IUS has switched back to a good antenna. 

2.2 J] Checkout 

As shown in Table 2-10, Boeing states that the IUS checkout 
functions are accomplished within the scope of the contract. No 
unique checkout requirements are identified for NASA prelaunch 
and predeployment operations. In previous NASA programs, ground 
checkout software has been much more comprehensive than the 
functions provided by the IUS software. "Additional checkout 
functions may be identified as the Boeing design of NASA-unique 
software matures. 
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Table 2-10 


3. 


SOFTWARE DESIGN ANALYSTS 


During the course of this study, M&S Computing performed a 
thorough engineering and data system analysis of the evolving 
design of the. IUS software- and its potential, with respect to 
fulfillment of the NASA requirements^ Three major documents 
were- evaluated in the study effort. 

These are: 

• ■ IUS Computer Program Development Plan. 

• Computer Program Development Specification (Type B-5) . 

• Computer Program Product Specification (Type C_r5) . 

In addition, M&S Computing supported appropriate technical inter- 
change meetings, software working groups, and preliminary/critical 
design reviews. 

This section describes the results of the design analysis, dis 
cusses the status of NASA-unique requirements with respect to the 
software design, and highlights our concerns with the current de- 
sign and its likely effect on NASA mission support. This section 
also provides a review of the latest NASA-Unique Software Schedule 
and points out inconsistencies developing out of- continued schedule 
compression. The details of support provided to technical inter- 
change, software .working group, and design review meetings are con- 
tained in Appendix. C . 

3 . 1 Detailed Design Analysis 

The design analysis activity focused on four consecutive re- 
leases of the IUS Operational Software Computer Program Product 
Specification, TRW Document Number 33332-01*. dated: . . 

• September 28, 1978. 

• November 16, 1978. 

• December 29, 1978. 

• March 30, 1979. 

These documents were reviewed from three different aspects: 

(1) compliance with proper software design standards and procedures 

(2) faithful implementation of requirements as defined in the appro 
priate, corresponding level of_ the IUS Computer Program Development 
Specification (Type B-5); and (3) compatibility with NASA-unique 
software requirements. 

In addition, as a separate, but closely related effort, the 
Computer Program Development Specification for "MOS (Mission Opera- 
tions Segment) Postprocessing Software, Parts I and II," 3oeing 
S290-50010, October 16, 1978, was evaluated to determine the validi 
and acceptability of the mission data load support software. 
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3.1.1 Overview 

The first (and most lasting) impression gained from this 
analysis effort is the overwhelming volume of documentation in- 
volved. The documentation' results from a laudible and-conscien- 
tious attempt to adhere to modern program practices; .however., it 
also creates new problems. First of all, there are too many re- 
leases of complete requirement/design sets. The traceability from 
design statement to requirement statement, (of - equivalent release 
levels) is excellent. Maintaining a library of current equivalent 
levels of Type B5 and -Type C5 specifications is difficult. Identi- 
fication of changes/differences between release levels is virtually 
impossible. This problem has been compounded by the lack. of an 
active, current Software Problem Report (SPR) file and timely distri- 
bution of Advanced Documentation Revision Notices (ADRN's) and Spe- 
cification Change Notices (SCN's). 

In general, the design adheres to good structured design prin- 
ciples. If anything, it might carry the refinement process -too far. 
Some functions are fractured into quite small modules. The handling 
of interrupts and lack of software test considerations (e.g., power 
up, inhibits, etc,.) presents some concern; however, these are more of 
a .requirements deficiency than a design flaw. 

The major concerns of the DOD/STS IUS software design, as 
presented in design reviews., center on the timing and si 2 ing over- 
runs. Again, the solution lies as much in tightening of require- 
ments as in design modification. Both the prime contractor, Boeing, 
and the software developer, TRW, are working toward solutions to 
these problems and have made significant progress. The open question 
is whether the gains made in the current design will be of sufficient 
magnitude to absorb the addition of known or unanticipated NASA 
requirements. 

3.1.2 DOD/STS Design 

The specific observations made during the design analysis of 
each release level of the- Type C5 specification were documented as 
memoranda, placed in the IUS file, and distributed via technical 
reports to the NASA Contracting Officer's Representative (COR). 

These detailed memoranda are referenced in Appendix A of this report 
Tables 3-1 through 3-4 present a summarized/tabularized form of the 
observations made, deficiencies noted, and corrective actions taken. 
Each- table reflects the concerns evident at a specific Type C-5 spe- 
cification release level (Note: The paragraph numbers in the B5, 

C5 columns relate to Revision G and to the March 30, 1979, release 
respectively) ; consequently, some concerns are carried forward to 
subsequent levels awaiting resolution. The tables are structured 
by Computer Program Component (CPC) and each concern is referenced 
to the applicable Type C5 and/or Type 35 specification paragraph 
number (again, note that paragraph numbers reflect the March 30, 

1979 , . release) except in those cases where the concern is of a genera 
generic nature. Not all concerns have been resolved as yet. Satis- 
factory resolution of all concerns will be ensured only by careful 
monitoring of future releases of the requirement and design speci- 
fications. 
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3 . 1.3 NASA-Unique Requirements 


olntain r f 1 thorouah e a Ty?S C , s P ecifioati °h, (March 1979 ) does no” 
1290 ^ 1002 ^ Sr °? t P^®^ n ^ 5 ° 1 "l 978 ,^version^of 

S r i 

£“*?* M yP f ,, B5 »P»o a *M a tions to the software development c on - 
acre torn U.e., a concise set of requirements statements), 
of NASAeunique^requirements^are ? 16110168 “ te ™ S of ^mentation 

* tion n for S ?DRsI i 0 n; h ^ itChin 2 ' and lina -°f-sight compute- 
cion tor TDRSS , Orbiter , and ground stations. 

* stage S sique^e NASA SeC °" d Sta9e ae P arati °h a nd third 

* Attitude control and third stage spinup processing. 

* FOM U H^? f ~ merit - (F0M) calculati on and achievement of 
FOM design requirements. 

* Variable data update (command uplink) after deployment 
such as state vector update, initial conditions, Jtc ' 

S5^JlSa^^“J«=s=- 

1. ssi. 

3 *2 Design Concerns 


r 5 nr-in^ h ^ e * re * hiree ™ a 3 or concerns requiring close NASA scrutiny 
during the remaining development cycle of the DOD/STS IUS sv<?r^m y 

software. First, unless full consideration L given to th^N^A 

requirements during baseline implementation, the impact of additional 
resources to support NASA rumn'ram^)-,, cne impact ot additional 

constraints of EL! v requirements may exceed timing and sizing 

softwl^ mnd?ti^ h !- b line system ' re sulting in extensive system 

CQntro^of e the 0 IUS 1 i°* COn ^°™ d ^ ota ^ fad ^ d ^ atB ^ B ^ t ^® ai PP S ^P ara ^ oaat 

snnoint ^ on f lt r° ns / etc.). Third, the lack of compatible software 

P«mcuUr!i 5 in°? h ff in '^ OU3e valilatioj? and test - 

particulariy in the case of mission load data - may significantly 

increase software testing costs to NASA on a per-mission basis. * 


-SI. 


ok m , 

A I, 1 Ac. K is |»n n j. 


3 . 3 NASA-Unique Software Schedule 


Figure 3-1 depicts the most recent schedule for NASA-unique 
IUS software. Several points are worthy of mention. Most obvious 
is the fact that the schedule is rapidly becoming compressed. For 
example. Preliminary Design Review (PDR) is shown with, an approxi- 
mate six-month slip. Any additional slippage will certainly begin 
to affect the Critical Design Review (CDR) and, consequently, the 
final Planetary Navigation and_Control Equation Certification. Al- 
though NASA planetary software delivery is scheduled for. October 
1931, it should be noted that this software is required by the fourth 
quarter of 198j0l_-*. less than a year from CDR. 

The next apparent anomaly is the fact that the requirements 
development is now running in parallel with design. This is an 
unusual situation which ordinarily becomes expensive because of. 
the continual false starts and rework. In fact, coding is in pro- 
cess before the requirements are firm. 
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4. SOFTWARE TESTING . PRECEDING PACE BI.ANK- NOT. HI. W? D 
NASA-.unigue°software^and the ^/STS^Opf b ° th >th * 

SSiSfS 1 ^ 

at*o* . . iricatior. (of NASA-unique requirements) anrf tv * at 

assumption 0 that ltl%H is^Hpo^t'he 

test plans, procedures? and re^lts of°^ 9 ^ tS ?. ted! 

^LTdr'V* v *$y ^ &. 
tlonrSlf^-SoS^tTLKoS^^vJ'SS^ test evaiua - 

4-1 POD/STS OFS Testing 

4.1.1 Test Scheduling 

arr an !!fi edUiin9 * h ? first operational flight of DOD/STS re- 

samms& 

4.1.2 Test- Documentation 


is dev^efSLl^sLetnrSwlSs^riuafsoft 6 D °° S S ftWire CDR 

S 3 S 3 SSSr 

lISBIliilf' 

The Boeing Computer Program Test Plan o fl farn n n 0 n 
generic document that includes provisions for Jasa 1S \,? 0re 

ver™!Sation r0U9h ^ ? resents «>. test philosothy foi ?-JS liftwkre 
ver ^i? atlon/ Preliminary qualification testinc (pot) snd r -; n .i e 

quallfxoation testing (FQT) with schedules fo^the^three soltSare 


configurations . The !, short==mInTJ«m 

Jxt^are development schedule. 


an out-of-date soj 



V 


i. 




4* 1*3 Test Facilities. 


(VSV) Simulator in the 

1979 for Titan) and is beoinnino 1S nearin 9 completion (July 
gration tests. Phasing the 0FS 9 inteqratio£ Jf® liminar y °*S inte- 
hefore the V&V simulator is fully chicked t6Stlng to begin 
will implement the breakpoint/restart Thls V&V simulator 

ference_5 and at the Vsv'softwa^R by^SFC^r^e!?" ^ **' 

4 ‘ 2 NASA-Un ique Software Testing 

4.2.1 Test- Scheduling 

NASA-unique P sof tSLe h Lvelopment°schedule S has ftW ? re ' deliver y on the 

fleeted in Boeing schedules. EimiS ? not yet been - re ~ 

of .DOD/STS two-stage validation Is within^h* 3 that the com Pletion- 
ginning of NASA Twin Stage validating £ t ^ ree m ° nths of the be- 
unique software coding a?d testing 5 hls period ' NASA- 

for facility and iHanpow^resou^L S Wlth th ? D0D P a ^kage 
closely involved in the. TRW verificatin? SA n?? rS °?? el must remain 

t0 ensura that the final soft£a£X * AC . valld *tion_, and IV&V 
NASA mission requirements. software design satisfies the 

4.2.2 Test Documentation 

the NASA^CDR^^Ther e fore ^h^FOT* a* 0 * £ ’ h ° Uld be u P dat * d prior to 
after the CDR (see Figure 3 - 1 ) tW ° months 

in_early January of lISo to suppo??. ? h e NMA cSS? * “ leaae 

for release by^&s^omputing^ document scheduled 

poned. Test requirement's? hi contract Period was post- 

requirements, and, as sttion% So? f®? Up ° n a good set of design 
not mature enough to write even a the NASA * Addendu m is 

ments. a reasonable target date • Set of test re cuire- 

defini-tion is in October of 1979 test re< ?uirements 

from. March to August 1979 ? and ? ?hf the NASA PDR (slipoed 

update on September 1 , ligurH-U? CPDS 

to be reflected i^the^UASA^dw 00 ^" 9 3ystern engineering analysis 

of meaningful test recuirfmentf ^ and sti11 allow «>« »1 «m“ 
February 1980. equlrements P«or to the NASA CDR in 

4.2.3 Test Facilities 

fa=iliSiirto P vn!r;hat S t h e S sLf eVel0ped , in - house ^‘-vare test 
all system or mlsslin regur?"me«s r "hf^ UC f aatis;iad <*• over- 
Sortvare Requirements Definition I^udC h %S?* ;lusi0 " o! th ® IVS 
a real-time test facility 


S.!”?iSS.“-J B SS2S t thf Ld erif j Cati ° n and valida ‘ d °" Pr=- 

dation (IV&V) LL?ities MSFC m iw d =?®?? ent ^ Verification and vali “ 
ments, desigi, S' The ' r ?? Uire - 

llTtot ev^uaworofr^ft^e^oft^ 7 ' ™? tacMues^favaila 
Boa{ng S £a=Llt mUlat ?, r °* the ““t^arle^f ^V^laoUily ^ 

carSul coorlSa^on o?°the r ?I^ e *" inde P enda “ test facility! but 
avoid performing duplicate tests ?" d procedures could 

unique software? The In-L^sI fv^ efloJi validate ^e NASA- 

ing tasks from test facility personal? * ld requlre the follow- 
• ^ that «- • 

‘ |FI no^specif ic^ontent} 

a - procedure U cross-ref erence 65 ^ ' 

SSSJ *L s 2i s P laa ah °“ld reflect 32 SSStofT'SS for 
DOD/STS software testing and the corresponding test re- 

* fSrsjssL^a^sr requirement 

‘ fn^the^oftware^validatio^tests ? 62 SUitaWe f ° r par£ °™- 
‘ OT^EJsSE? ° n the IUS soft « a fl^eased to support 

* s^io^e^Lr^jrs^^' (spr,s > *> 

* ^^re^oplfso 1 ??^: behavior ? hS t " t 

F"? 1 fi c ^“ 1 2 ok " evaluation report should be delivered 
within 10 days after completing each test milestone. 

test feport would be required 30 days af^er com- 
pleting each test milestone. 

Data packages containing reduced test data, "as-run” 

S™?f^', S?R,S ' and Copies of test conSicto? ^ocs 
would be delivered to NASA. ~ ogs 

" ?J t ?/? C ° rded durin ^ final (demonstration) t*st runs 
ZSftS ESST* UntU 30 a£t ~ ^ associated 
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PRIMARY VERIFICATION AND VAUDAJION ACTIVITIES 








• SPR’s would be retested upon resolution and a closeout 
disposition submitted to NASA. 

NASA would analyze the test results to determine whether the 
IUS software meets requirements for launch. 

The primary mode of software testing should use a real-time 
simulation to drive the flight software as it -executes on an IUS 
flight computer (Delco M362S) . A secondary testing mode using an 
interpretive computer simulation (ICS) may be used to supplement 
the above real-time testing. 

It is anticipated that some modification of the Boeing V&V 
simulation used to test the basic DOD/STS flight software package. 
wlJ 4 r ® ( 3 u i r ©d NASA software testing. The extent of these 
modifications is largely dependent on the requirements for attitude 
control during third stage spinup and on the design of the guidance 
software. . MSFC' expressed these concerns at the V&V Simulator Soft- 
ware CDR by submitting two Review Item Discrepancies (RID'sJ - see 
Reference 7 . Boeing stated that specific V&V Simulator modifica- 
tions for NASA testing would be -addressed at a later date.. A sub- 
sequent schedule release included the. update (see Figure 3-1) , but _ 
specific modifications, have not been identified. 
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5. 


INTERFACE ANALYSIS 


The IUS interfaces with the NASA communications, network , the 
third stage, and the spacecraft were analyzed. M&S Computing 
activities associated with each of these interfaces are outlined 
in the following paragraphs, 

5.1 NASA Communications Requirements Evaluation 

In-flight Telemetry, Tracking, and Command (TT&C) require- 
ments. for the IUS have been collected from References 14 and 17 and 
depicted in Figure 5-1. It can be seen from 5-JL that all NASA 
missions require continuous tracking from the STDN system (Reference 
18) or TDRSS (Reference 19). from lUS/Shuttle separation to space- 
craft (S/C) separation for twin stage missions, or spinup for spin- 
stabilized missions. 

Telemetry of state, vector and attitude data is required at all 
solid rocket motor (SRM) burns. Commands to arm the SRM's are re- 
quired for all burns and also to arm the S/C pyrotechnics. 

The actual TT&C space-to-ground linkage is controlled by the 
IUS software. This software selects one antenna of the onboard 
antenna array that points to the closest ground station (see Re- 
ference 2a) relative to the IUS. This selection process includes 
the TDRSS satellites which are loaded as ground stations having 
geosynchronous altitude. The reliance on the onboard software to 
select and maintain continuity, of RF transmission for telemetry 
and command data is subject to various physical limitations on the 
STDN and TDRS systems that could, under many conditions ^result 
in short or long term losses of. communication; herein referred to 
as dropouts.. The following paragraphs describe some of. the limita- - 
tions on the STDN and TDRS systems and-.should lead to the. conclusion 
that the TDRS system cannot be handled as just another set of ground 
stations. The major system limitations to be considered are listed 
below .and collected in Table 5-1 along with system impact precictions 


• IUS antenna switching dropout. 

• TDRSS - Zone of exclusion. 

• TDRSS - Antenna steering angle limitations. 

• TDRSS - Earth grazing angles. 

• TDRSS - RF earth impingement limitation. 

• TDRSS - Handled as ground station (signal strength) . 

• STDN - Ground effects (low elevation angles). 

e STDN - Station masking (keyhole and terrain limitations). 

• TDRSS and STDN - Thermal noise due to sun-IUS orientation. 
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TT&C REQUIREMENTS 









4 , 


4 


The last paragraphs of this section describe a combination 
of these system limitations as they act upon a typical Galileo 
mission (Reference 4) to dropout communication prior to second 
SRM ignition. 

5.1.1 Antenna Switching Dropout 

IUS telemetry and command dropout due to antenna switching 
is discussed first for command reception and second for telemetry 
transmission . 

• Command reception when switching between antennas in the 

STDN mode. 

- May lose phase lock for 2 to 20 milliseconds during 
switching period. 

- Reestablishment could take 500 milliseconds. 

- Each antenna switchover could result in 520 milli- 
seconds of command or ranging loss. 

- Commands may require repeating. 

- Ranging may be- disrupted. 

- Operation in the TDRSS mode will be similarly affected. 

-- The command reception design meets the IUS requirements 

for NASA compatibility of STDN or TDRSS signals. 

• Telemetry Transmission 

- Telemetry data utilizes two STDN compatible subcarriers, 
one- for pulse code modulation (PCM) and one for analog 
vibration data (frequency modulation. (FM) ) . Both are 
compatible with STDN or Orbiter. 

- FM vibration data is not transmitted through TDRSS due 
to format incompatibility and insufficient signal margin. 

- An RF command can override onboard computer software antenna 
selection for 30 seconds. After 30 seconds, the onboard 
algorithm again gains control of antenna selection. This 
prevents an inadvertent lockout due to an incorrect 
selection. 

- While switching between antennas the receiving site may 
lose phase lock and PCM decommutate lock due to the 
switching transient. This period is estimated to be less 
than 2 3/4 seconds for STDN and TBD for TDP.SS . 

- The telemetry transmission design meets the operating 
requirements* for STDN or TDRSS compatibility. 
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Table 5-1 
(Continued) 


5.1.2 Limitations of the TDRSS 
Zone of Exclusion 


The fixed positions, relative to the earth, of the two geo- 
synchronous tracking satellites result in a " 2 one of exclusion.-" 

This zone is a region where TT&C cannot be conducted by TDRSS as 
neither of the satellites can see Into this zone. The zone is 
formed by the intersection of two cones of visibility (with re- 
spect to each satellite) and- the sphere of the. earth. Details 
of the. location of the zone are given in Figure 5-2 and Figure 5-3. 

Steering Angle Limitation 

The maximum, single access antenna steering angle results in 
three regions of no TT&C capability with respect to TDRSS at various 
ranges of latitude and longitude above altitudes of 12000 kilo- 
meters. Details of these regions are contained in Figure 5-2. 

Earth Grazing Angles 

TT&C signal attenuation due to earth grazing angles, (angles 
less than, six degrees}. The angle, formed by the tangent to. the 
earth .Ls surface through TDRSS and the line through the TDRSS and 
the point being ob ser ved. Refer to Figure 5-4. 

RF- Earth Impingement Limitation (Flux Density Limits) 

International limitations on the power level of' an RF signal 
impinging on the earth may result in a potential coverage loss due 
to reduced power levels of transmission (Reference 4).. 

TDRSS Simulated as a Ground Station 


The signal strength of an STDN station will exceed that of a 
TDRSS. Optimal signal strength will be a function of transmission . 
power .and is not defined by the closest station concept as outlined 
in the IUS software requirements. 

5.1.3 STDN _ 

The STDN station locations are described in Figure 5-5, 

Station Masking (Keyhole and Terrain Limitations) 

Ground stations are subject' to restrictions in elevation and 
azimuth due to local terrain such as hills and buildings. Addi- 
tionally, hardware mountings (keyhole limitations) further restrict 
their overall movement. Examples of these azimuth and elevation 
restrictions (called station masking) are described in the follow- 
ing paragraphs for the Goldstone and Madrid stations. 

From Figure 5-6, there exists a loss of communications with 
respect to the Goldstone Tracking Station for an azimuth near 
272 degrees from 0 degrees to 23 degrees in elevation. Similarly, 
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gure 5- 



srstssr j^s k$sv:;.- 

Ground Effects 

s:?£i\=sl£^ 

sjst -*“™. “stn.s^ssis ssss,““ 

Cumulative Effect 

is S hown y in°?iaS“ U 5-7 tl ?or e thrplf *=ting °» the tdrss 

p-i j e . _. t , ' rojr the Planetary Mission Profile 

^niin^ 0 =c D Ss ln It“h i |^ a 1 ^2a a rofJr enCe stage. 

TORS^lfa^it" ° r 2h- K ? uld tssuit to SS:^ ?^c U ?^gh T tol'- 

r«p2=ti2 SS^'cSSS ifSlSLi; at a . sma “ 2$. *tn 
is*JSti; al > outside itSto^toifis?“tori I . ,h1 ' 

Pigurls i^\hr% 5 h te 5 - 7 rences 18 and - W for further discussion of 
5 * 2 Third Stage Interface Analysis 

fr a „si?2?f^2te bet E« n 2^ e ii U ? s ff ond . an f third stages are in a 

SHIf8i s lF 

J82%S & SRM ' 

SSS& oa^sr^sL^^r^ssSS-^l^^^ 

faces are still being negotiated and may change^beflre topUme^Hlon 

evaluations Stage interfac e a ^o encompasses the 

effects (with control Lid 2iSSSt con?rol)' t orthird t sL d T miC 
spinup. some of the spin dynamics ‘par^ie^ to^e InTy^I^ 


M, 


1/ RCS thrust uncertainty. 


Spin rate at which active control is terminated. 
Final spin rate uncertainty. 

Second stage separation effects. 
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IMPACT OF REMOVING THIRD STAGE AVIONICS 


Interfaces 

With Spin 
Stage Avionics 

Without Spin 
Stage Avionics- 

IUS Twin Stage 
to 

Spin Stage 

8 Spacecraft 

Discrete 

Commands 

2 Spacecraft 

Discrete 

Commands 

IUS Twin Stage 
to 

Spacecraft 

N/A 

< 6 Spacecraft 

Discrete 

Commands 

Spacecraft 

to 

Spin Stage 

S/C Measurement 
{for 100 bps 
telemetry) 

♦SRM Arm _ 

(4 circuits) 
♦SRM fire 
(4 circuits.,) 

Spin Stage 
to 

Spacecraft 

Payload 
Separation 
(2 circuits) 

♦Analogs/ 
discretes (hard, 
wired ignition 
measurements ) 

Spin Stage and 

Spacecraft 

Telemetry 

256 bps: 

Spin Stage 
transmission 

256 bps: 

Spacecraft 

transmission 


♦New interfaces 


Table 5-2 


• SRM 3 burn. 


- ISP, thrust alignment uncertainty. 

- M , I uncertainty. . 

• Flexibility .effects.. 


• S/C separation effects. 

and °? h ® r error sources contributing to the fom per- 
formance are covered in moxe detail in Appendix A. 


A related short study was conducted durinq th® contract 
to determine whether the IUS would accept an IUS State Vector P Up- 

that thiS^roS^^SodStf 1 ^ l ,5 Ur ?‘ ,^ al y si -s-by JPL and MSFC indicated 
*7 s ? rou ? d update would significantly improve the FOM perform- 

that thf Tn? ne ^ a f y misslons *- The flight software analysis revealed 
matt t J^ 3 sta ^f vector command was inoperative after IUS deploy- 
ment. Subsequently, the command was deleted from the CPDS Boeinc 

T ^ ate / e «° r update to be an imprSvemen^in 9 “ 

capabilities therefore ' the ^ do not P lan to incorporate the 


5 • 3 Spacecraft Interface 


changes noted in the previous section for removal of the 
third^stage avionics are the only modifications to the spacecraft 
interfaces for NASA vehicles (twin and three-stage) . NASA MSFC 

? Usht Centsr <GSFC ' be heavily involved^ in 

ui.£ IIS DOD/STS software modifications due to the requirement for 

3oeinq U £CP • C ^ tr ° 1 du 5 in 9 deployment of the TDRS appendages. 

1^=22 EC ? ZS I°5 22 lndicat as that a new CPDS addendum will be re- 

and cheJkout°fi:t?^ 1Cn i m f de . to the 6D0F Emulation, V&V simulation 
and -checkout station. Analysis associated with these activities 

will occur during late 19.13 and early 1980. 
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6 . CONCLUSIONS AND RECOMMENDATIONS 


This section presents the study conclusions from 
devi? cont ^ a °t tasks and recommended actions to ensure 
development of the IUS software for NASA missions. 


the four 
successful 


6 . 1 Conclusions 


dave 1 ow^t^ y u“S r Se 1 Swf OCiated With thS NASA -“ ni <^ software 

* «DtXd^°f«“nc^te? ent3 33 docufflented in 

* a S? e ? eta ^ led design specification develop- 
f°J the NASArunrque software will be adversely 

affected by delays in requirements baselining. 

* emulative attitude control and guidance errors may 
prevent the IUS from meeting the JPL FOM requirements. 

* Manual certification of- 20 to 30 mission data load 

w! a ?! S a ?.^ re " tl Y retired for planetary missions 
ill be very ditficult in a short time period (i.e., a 
reissue shortly be for e launch) . 

* Development ^ of the.TDRS Addendum to the CPDS will be 
on i very tight schedule with initial requirements 
relea.se only eight months prior to launch. 

IT ma i° r software concerns were alleviated during the 
- aborting period by the following actions: 

1. The DOD/STS CPDS was baselined. _ 

2... Boeing and TRW brought the sizing and timing estimates 
within computer capabilities, 

such that a * a S e,-,5L Sllp the software subsystem CDR schedule 
suen that a delta software CDR was held May 1 throuch 3 1 Q 7 Q n e 
months after the IUS System CDR). trough 3, 1979 (2.5 


rhe -all* of ^l-a" Sf. Preliminary design of the ms scftwa 
" e ^ 7 or ~ 9 ' 8 ' tneir estimate ror software sizinc ard - 

?e^ 8 was SSSd" a C S! blUtl V- A Joint SAMSO contactor' 
team was ^ormed tc address tne problems. The Ti*-a- scftwa 

sizing estimate has now been reduced from a hi~h 63 -no 

to t7 600 and DOD/STS software from 6o”So vcrjS U 5 V, i 

Al.h currently proposed design chances, Boeing orejects a 

reduction to 53,145 for Titan and 50,395 for Icd/S-S -e 

latest estimates do not include anaLlocatl^ for -;ksk- k‘*~ 

so.. t«are . aewsver, preliminary NASA-unique requirements i 


:e m 

! — \ •» *-> 
bA.l 

:ask 

:e 

words 
words . 
iuther 
>e 
ue 

a 2 dn i 




1 'i 


Q. 



re«JS* “ iU rom * in BMinfl'a 

margin for the test phase Trad?^^?? 6 a comfort able growth 
cause memory increases * ^ aditiona lly, problems during test 

the NASA software design. matu^L^n^ 0 ^ 1 ^ t0 be monit ored as 
of 50,995 words for DOD/STS is reali2ed Ur %of? t the ?°? ing estimate 
is no longer an overriding concern. d * Software_sl21 ng/ however, 

(10 msec, lo^sec^Io msec^O f^ec f i A ? ht s ° ftware tiding slots 
200 sec) all exce 4 ded lof ierclnt 3ec ' 10 sec ' a * d 

case timing paths in October 1970 f n th !: al ?-°cetion for worst- 
had, been reduced to. a worst case of March. 1979 timing estimates 
10 millisecond (msec) slot All u ^ ili2ation for the 

reaction limits. Again the NA^A^nt!! 9 ' lo i estjjna tes . are below 
not included in the 9 TRW 'estimates. qUe softwara specification is 

6 *2 Recommendations 


MSFC shoul^remain^eeply inv!lv£Tin all^h NASa ‘“ Ili J ue software, 
production.. Involvement should fni t n a fu phas< r s of the. software 
in Figure 4-1 whtaHE* rei“rft^ 

• Requirements analysis. 

• Design analysis. 

• Software-testing. 

Specific recommendations for these activiHae av . 

the following paragraphs. activities are presented in 

6.2_1 Requirements Analysis 

is thrd%”^op^ro£ 0 rc^p r e f henatve'set 9 o? 1US ? li ’ ht 
sourcesf Sh 

?or d p?^etSy1issiSns? nd C ° ntr01 <W,SC > ™I»ir— »t. 

• Unique communications requirements. 

• Three-stage configuration requirements. 

• TDRS software requirements. 
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Guidance, Navigation , and Control Analysis 

The IUS attitude control system must provide stable attitude 
control for all flight phases. For powered flight attitude .control 
during first and second SRM burns and corresponding RCS vernier 
burns, the DOD IUS provisions have been accepted by NASA. 

For the three-stage spinner missions, the IUS must provide 
the capability to spin the third stage/spacecraft up to 70 rpm 
for a .spin-stabilized third stage burn. There are no specific 
requirements placed on spacecraft separation .attitude. Since the 
three-stage spinner IUS vehicle is unique to NASA missions, the 
demands placed on the attitude control for spinup are NASA-unique. 

Recently, the design reference mission and planetary injection 
accuracy requirements have been changed (see Section B.3 of Appen- 
dix B) . 

At present the FOM (see Reference 21) is the only require- 
ment placed on the guidance, navigation, and control accuracies. 
Further analysis of the IUS capability to meet this requirement 
is recommended. 

Boeing, for the design analyses of the coast attitude control 
system, has employed a digital computer simulation (Reference 22) 
which inludes the following: 

• Simplified rigid body. 

• Blow-down thrust level. 

• -Detailed control algorithm. 

This anlaysis tool is being used for detailed spot checks. of 
performance. This simulation does net have the capability to 
account for the wide range of parameters (as stated in the error 
sources Section B.4 of Appendix 3), or. to fully determine statis- 
tical injection errors that the spacecraft will be required to 
correct. 


To determine correctly the injection errors due explicitly 
to the control law. (and navigation implicitly) , we recommend, 
that a detailed computer simulation be developed. This simu- 
lation must include all of- the attitude control error sources 
(see Section 3.4, Appendix 3), ir. describing the dynamics of the 
IUS /SC and should also incorporate the control law as proposed 
by 3oeinc. The simulation results will have the following 
utility: 

• Evaluate 3ceing's control law for spinup. 

• Quantify the control software's contribution to 
injection errors. 


Define the inherent capabi 
for third stare SRM burn. 


Communication Analysis 

TT&C operations represent a major portion of the NASA-unique 
software requirements. None of the communications have been 
fully addressed in the CPDS NASA Addendum; however, current Boe- 
ing requirements (CPDS Addendum Revision H) specify that STDN 
and TDRSS cannot- be used simultaneously on a single mission. 

During the MDL tape load,, either one network or the other is 
loaded, but not both. By using this scheme, Boeing avoids chang- 
ing the- DOD/STS. software. Unfortunately, this design will not 
provide the coverage specified in. SS-STS-100 (Reference 14). The 
following related STDN/TDRSS requirements must also be resolved, 

• Autonomous on-board, selection of the communications 
mode (Orbiter, STDN, or TDRSS) . 

• Removal of failed antennas, TDRSS stations, or STDN 

stations as candidate communications links. 

• Maintaining communications -of telemetry during spinup 
to obtain final -attitude prior to third stage ignition 
(prior to loss of RIMU reference) . 

Three-Stage Configuration Analysis 

In addition to GN&C performance analysis, the third stage 
hardware interface requirements affect the software. Software 
modifications associated with ECP 247 should be., tracked _to ensure 
that SRM3 ignition sequence events are coordinated properly, with 
the spacecraft. 

TDRSS Requirements Analysis 

Implementation- of the DOD/STS software changes associated 
with the TDRSS appendage deployment will be on a tight schedule - 
eight months between TDRSS CPDS Addendum release in April 1980 
and the launch in December 1980. During this period, the adequacy 
of the design must be verified with all analytical tools (6DOF 
simulator, V&V simulator, checkout stations, etc.). 


Ideally, the software design for the TDRSS would not only 
provide IUS support for TDRSS, but, also, provide a flexible 
control process that will support other missicn-unique spacecraft: 
operations for DOD two-stage and NASA twin-stage vehicle configu- 
rations. Analysis of the requirements and design should attempt 
to remove unnecessarily restrictive specifications . 

6.2.2 Design Analysis 


Analysis of the NASA-unique software preii 
dependent upon developing a concise requirement 
this reason, the software design presented at t 
adversely affected by the parallel requirements 
in the -schedule in Figure 6-1. Since the requi 
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must be considered incomplete. A similar situation during DOD/STS 
software development has resulted in a delta software CDR slipped 
until two months after the sytem CDR. An update of the CPPS after 
completing planetary equation certification in April of 1980 could 
easily slip the NASA software CDR until June of 1980. MSFC needs 
a detailed software development schedule from Boeing that indicates 
its planning to meet the PDR, CDR, and delivery milestones, 

6.2.3 Software Testing 

Verification and Validation (V&V) of the IUS flight software 
for NASA missions should be directed by NASA. Design analysis 
tasks should be performed by NASA to identify not only, that the 
CPDS and the CPPS meet NASA mission requirements, but also that 
Boeing tests thoroughly verify the basic. DOD/STS software package. 
Independent software testing will be performed against test require- 
ments developed by NASA which specify, the types of software tests 
needed and the success criteria for each requirement. Since NASA 
has no IUS software development facility, the tests jwill be per- 
formed- on a DOD facility - either the Boeing Company, facility or the 
Martin Marietta facility,. These independent tests of -the NASA- 
unique software should, attempt to avoid direct duplication of 

validation tests. This independent test effort will attempt 
to supplement, not duplicate, Boeing testing. 

MDL tapes released for NASA TDRSS or planetary missions must 
be certified before flight. This certification could become a 
problem for final-changes close to a launch date, with 20 to 30 
tapes per mission, certification will become a time— consuming 
process. Therefore, we recommend developing an MDL tape certifi- 
cation program at MSFC to automatically crovide the following 
capabilities: 

• Limit comparison tests. 

• Tape sum check. 

• Validation .of day-to-day retargeting (from one tape 

to the_next) . 

• File builder to provide data parameters for a 6DOF 
simulation test of the mission. 

• Plot routine to display the daily launch variations. 

This program will provide a quick assurance that the MDL • **ace 
updates are accurate. 
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Memo 

NO. 

Title 


Date 

- 

IUS-78-013 

Monthly Progress Report for 
May 1978 

June 

S, 1978 

" 

IUS-78-014- 

IUS Software Working Group Meeting, 
June 5, 1978 

June 

7, 1978 

- 

IUS -7 8 -015 

NASA Unique IUS Flight Software 
Requirements 

June 

20, 1978 

— 

IUS-78-016 

Evaluation of the IUS Computer 
Program Development Plan Revision A 
dated- February 28, 1978 

June 

23, 1978 


IUS-78-017 

IUS File Subjects Proposed Changes 
to SS-STS-10G, Volumes. 3 and 3-1 

June 

28, 1978 


IUS-78-018 

Monthly Progress Report for June 
19-78, Contract No. NAS8-33072 

July 

10, 19.78 


IUS-78-019 

Evaluation of IUS- Support Software 
Requirements 

July 

11, 1978 


IUS-78-020 

IUS Software. Development Schedules 

July 21, 1978 


IUS -7 8 -021 

-Software Impact cn Planetary Mission 
Accuracy 

July 

31, 1978 


IUS-78-022 —Monthly Progress Report for. July 
1978, Contract NAS8-33072 


August 8, 1973 


I 

I 

I 
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IUS-73-023 

Evaluation of the Redundancy Manage- 
ment Requirements for Inertial UpDer 
Stage (D290-1Q086-1, Revision B) 

August 3, 1978 

Iua=78-024 

evaluation, of the Interpretive 
Computer Simulators (ICS) CPDS* 
CPCI No. ICS 0001.. 

August-25, 1978 

IUS -7 8 -02 5 

P Report — IUS Baseline Design 
Review No. 4 and Guidance Technical 
Interchange 

August 29, 1973 

IUS-73-026 

Monthly Progress Report for August 
1978, Contract NAS8-33Q72 

September- 8, 1978 

IUS-73-027 

Evaluation of the NASA Addenda to 
the Prime Item Development Steci' 5 • 
cation (PIDS) for DOD Two-Stage 
Vehicle Inertial Utcer Stace, 
S290-70001. 

September 14, 197 
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Memo 

No. 

IUS-78-028 

IUS-78-Q29 

IUS-78-030 

IUS-78-031 

IUS-78-032 

IUS-78-Q33 


Title 

September Update of the IUS 
Software Development Schedules 

Evaluation of th§ IUS CPDS NASA 
Addendum S290-51002, July 28, 1978 

Gamma Guidance Trajectory Depen- 
dence on Initial Guess for SRM 
Steering Angles 

Monthly Program Report for Sep- 
tember 1978 r Contract NAS8-33072 

Trip Report for the IUS Software 
Computer Product Specification 
(CS) Technical Interchange Meeting, 
October 10-11, 1978 

Evaluation of the IUS Computer 
Program Procurement Specification 
S-2 9 0-514103, dated September 15, 

i Q T O m s 


Date 

September 14, 1978 
September 26, 1978 
September 29, 1978 

October 10, 1978 
October 17, 1978 

October. 25, 1978 


IUS-78-034 


Evaluation of the IUS Computer 
Resource Integrated Support- Plan 

* D2 9.0-10151-1, September 28, 
1978 (Draft) 


November 6, 1978 


IUS-73-035 

IUS-78-036 


Monthly Progress Report for October 
1978, Contract No. NAS8-33072 


November 9-, 1978 


November Update of the IUS Software 
Development Schedules 


November 16, 1978 


IUS-78-037 XUS Spin Stage Equations of Motion 


November 20, 1978 


IUS-78 -038 


Trip. Report for the IUS Software 
MOS Postprocessing PDR and OFS C5 
Specification Technical Interchance 
Meeting - November 29-30, 1978 


December. 11, 1973 


IUS-73-039 

VOID 



IUS-73-040 

Monthly Progress Report for November 
1973, Contract No. NAS8-33072 

December 

3# 

IUS-73-041 

IUS Technical Project Review (TPR) 
Software Splinter Session 

December 

13, 


Memo 

No, Title 


IUS-78-042 Gamma Guidance Trajectory Depen- 
dence on Initial Guess for SRM 
Steering Angles (Galileo Mission) 


IUS-78-043 Explicit Definition of the NASA- 
Unique Re quirements 


IUS-79-001 Monthly Progress Report for Decem- 
ber 1978 , Contract No. NAS8-33072 


IDS-79-002 Evaluation of the IUS Software 

Computer Program Product Specifi- 
cation (C5) , December 29, 1978, 
Release 


IUS-79-003 Monthly Progress Report for January 
1979, Contract No. NAS8-33072 

IUS-79-004 Trip Report - Software Working 

Group. Meeting and MOS Data Format- 
ting PDR, January 31 and February 1, 
1979 


IUS-79-005 Evaluation of Boeing Response to 
NASA VSV Simulation CDR RID'S 


IUS-79-006 

IUS-79-007 

IUS-79-008 


Trip Report - Guidance Subsystem 
CDR, February 21, 1979 

Monthly Progress Report for February 
1979, Contract No. NAS8-33072 

Software Problem Reports for. the 
NASA B5 Addendum, S 2^-5 10 02 


IUS-79-009 Update of the IUS Software Develop- 
ment Schedules 


IUS-79-010.. Evaluation of. the Boeing Software 
Development Schedule for NASA 

IUS-79-011 Monthly Progress Report for March 
1979, Contract No. NASS-33072 

IU5-79-Q12 Contract NASS -23 072, Final Report 
(Draft) 


ILS-70-0 13 Monthly Progress Report for April 
1979, Contract No. NASS -33 072 

IUS-79-014 Monthly Progress Report for May 
1979, Contract No. 33072 


Date 

December 21, 1973 

December 27, 1978 
January 10, 1979 
January 31, 1979 

February 8, 1979 
February 13, 1979 

February 28, 1979 
February 26, 1979 
March 9, 1979 
March 21, 1979 
March 19, 1979 
March 30, 1979 
April 9, 1979 
Nay 2 , 1973 
May 10, 19 "9 


June 11, 1979 
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The baseline guidance scheme for XUS is Boeing's Gamma 
Guidance. This scheme solves the guidance problem for performing 
orbit transfers with a space vehicle having a fixed velocity impulse 
Solid Rocket Motor (SRM) . Gamma Guidance permits onboard targeting, 
orbital maneuvers, and interplanetary injection. This scheme is 
based on matching the required set of velocity impulses with the 
impulses available from the XUS. 

The transfer orbit is subdivided, from a guidance standpoint, 
into a series of arcs and phases. Arcs define, all the potential 
coast and powered- flight sectors. Each flight phase identifies a 
portion of the transfer orbit where the guidance philosophy is con- 
stant. A phase comprises a pair of coast/powered flight arcs. 

Figure B.l-1 shows how the vehicle configuration, guidance phase, 
and guidance, navigation and control (GN&C) software activities 
for a three-stage NASA mission vary with time. The arcs/phases and 
different guidance modes are. shown in Figure B.l-2. Phase 5 in 
Figures B.l-1 and B.l-2 shows the third stage, which will be spun 
up for stability by the IUS Reaction Control System (RCS) prior to . 
SRM, ignition. For this phase, Gamma Guidance will provide phase 
initialization, midcourse guidance, and preignition, but will not 
provide the closed loop guidance mode. Figure B.l-3 shows the 
events associated with the third stage. 

The operational flight software controls. the IUS in achieving 
the placement of an attached payload into a desired orbit.# following 
deployment from the orbiter. Software functions provide calculation 
and control capability for the following, operations: mission 

sequencing, guidance, attitude control, communications, redundancy 
management, checkout, and navigation. Here, attention will be re- 
stricted to the parr of the software which consists of guidance, 
attitude control, and navigation. 

The purpose of the guidance, function is to command orientation 
of the thrust vector and to command the SRM/RCS ignition times 
required, to. change the current vehicle state to an injection state 
that satisfies the mission requirements. The guidance is active 
during both coast and powered flight .modes. In the coast mode, 
guidance command changes result- from attitude control maneuvers 
and environmental perturbations. During powered flight, the 
changes arise, from off-jicminal propulsion system performance and 
hardware anomalies. 


Attitude control software provides commands to the reaction 
control system and thrust vector control (TVC) actuators to achieve 
and maintain various vehicle attitudes during the IUS mission. 
Control will be provided during powered flight as well as during 
mission coast phases. During powered flight, attitude control 
software provides pitch and yaw commands to thrust vector control 
actuators and roll commands to the RCS to maintain IUS attitude 
in an orientation defined. by guidance software. During coast 
phases, attitude control software provides roll, pitch, and yaw 
commands to the RCS to accomplish required attitude reorientations, 
thermal, and other attitude maneuvers required to maintain defined 


inertial attitudes. 
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GUIDANCE NAVIGATION AND CONTROL SOFTWARE ACTIVITIES 
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The purpose of the navigation software is to provide current 
values of IUS position, velocity, and attitude with respect to 
inertial space, given raw Inertial Measurement Unit ( IMU) 
accelerations and attitude rates as input. This software employs 
two modes of operation, alignment mode and space navigation mode. 
Alignment mode is entered and exited on command prior to flight. 
Certain functions are sequenced to effect mathematical alignment 
of the attitude quaternion. Position and velocity are maintained 
by direct computation. When in the space navigation mode, atti- 
tude reference is maintained by solution of a quaternion differen- 
tial equation. Position and velocity are maintained... by integration 
of acceleration and velocity. 

The above description of the guidance, attitude control,, and 
navigation software is generic in nature, i.e-, applicable to both 
the DQD and NASA. The NASA three-stage missions introduce several 
areas of uniqueness. The guidance software, which uses a gamma 
guidance algorithm, has several more control variables for the 
three-stage missions. Unlike two-stage missions, the guidance 
computations terminate . prior to the initiation of the .spinup 
(point 3 of F-igure B.l-3). The guidance software is inactive 
beyond that point as shown in Figure B..1-1. The attitude control 
software also has NASA-unique requirements. The three-stage 
missions call- for spinning the entire, second stage/third stage/ 
spacecraft configuration using the IUS RCS (second stage). How- 
ever, the attitude control software .activities cease prior to the 
termination of the spinup phase .(point 4 of Figure B.l-3) . There 
are no NASA-unique requirements for the. navigation scxftware. The. 
only impact on this software arises from the longer .duration of 
the planetary missions. This software becomes inactive during 
the spinup phase (point 4 of Figure B.l-3). 
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AC3 4 S3 -51* . 271 ,747. AC3*$2 -1400. * 560400 

AC3*S3 203140. feoOOOO 




In addition, error models should be incorporated in the 
guidance scheme to simulate the effects of (1) anomalies resulting 
from integrating the guidance gravity model during coast arcs, 

(2) IMU errors propagated during coast arcs, (3) off-nominal 
engine performance during powered arcs, and ( 4)... IMU- errors propa- 
gated during powered arcs. 
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B. 3 Reference Missions and Performance Requirements 

The current Inertial Upper Stage (IUS) System Specification 
(SS-STS-100, dated March 17, 1978) covers the following NASA 
Design Reference Missions: 

• Jupiter Orbiter Probe '82. 

• Mars '84 

• Saturn - Uranus Probe ’85 

For these NASA planetary missions, the guidance and navigation 
accuracies are specified by the following paragraph in the system 
specification: 

3. -2.1. 2 IUS Planetary Injection Accuracy. The IUS 
planetary and non-synchronous mission injection accuracies 
shall be determined utilizing the IUS inherent capabilities 
required to meet the synchronous equatorial accuracy require 
ments of. 3. 2. 1.2 of SS-STS-100 Volume 3 and the spin rate - 
requirements of 3. 6. 1.5. The computational procedures for 
determining the spacecraft delta variance shall be in 
accordance with JPL document "Determination of IUS Planetary 
Injection Accuracy" dated October 1977. 

The design reference missions and the planetary injection 
accuracy requirements have been changed recently (by ECP 247), 

The current design reference missions are: 

• Galileo (GLL) '82 

• International Solar Polar Mission (ISPM) '83 

a Venus Orbiting Imaging Radar (VOIR) '83 

The mass and injection energy requirements have also been 
changed, to be consistent with these new missions.- The paragraph 
(3, 2. 1.2) specifying the planetary injection accuracies has been 
deleted and replaced with the following: 

Injection accuracies required for Deep Space Missions 
are shown in Table B.3-1. For the purpose of evalu- 
ating planetary injection accuracies, the figure of 
merit (FOM) is to be calculated as follows i 

*V " A A INJ A 

where? A^ is the midcourse velocity correction covariance 
matrix (3 x 3) . 
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Table 



A INJ is fchQ lus injection covariance matrix (6 x 6) 
provided by BAC. 

provided by t JPL.° f trajector V sensitivities (3 x 6) 
T 

A is the A matrix transposed. 


dements of S ^? Xe r ° 0t ° £ Sum of the 

velocity, requLS^ecrlf? ° £ «» 
injection errors six P L r c “ ft at midcourse to remove IUS 
are mappid^l tte sfnall Son 3 t??? 0nentS '- ° f • the ^“ion state 
course AV magnitudl No snaf^ti 9 mlsslon Parameter, mid- 

individual components of the in jectionlS^e* (i a f e ° n th ® 

and velocity are not -sDecifiVai if, " . te U.e. local position 

determine a«ep?e§Uiiroi inv ms ?n?!^- ned> Z There ^e, to 
putation (a function of all US ln:jecti0n state, an POM com- 
is required. a11 S1X com P°*ents of the injection state) 

mhic 3*? computational scheme for POM involves a matrix A 
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B.4 Identification of Error Sources and Analysis Required 


The accuracy requirements for the planetary missions are 
expressed in terms of FOM. -A brief description of FOM is given 
below. .Most planetary missions are targeted utilizing the so- 
called aiming plane defined by the R, S, T encounter planet 
coordinate system. S is parallel to tKe Incoming asymptote of 
the spacecraft’s orbit, T is defined to be parallel to the 
ecliptic and orthogonal to S. R lies in the southern celestial 
hemisphere and completes the orthogonal right-handed, system. 

A convenient method for describing the spatial miss at target in 
this system is to consider where the spacecraft would penetrate 
the R-T plane for a massless planet. The distance from the target 
planet center to this point is referred to as the impact parameter 
B. B in turn is characterized by B • T , and B « R . Frequently, the 
deviation of the flight time from the nominal is desired, and is 
readily expressed in this coordinate system by knowledge of the 
spatial miss in the S direction and the approach velocity_(i.e. , 

3 5-V<» 3 t~) . For higK-energy planetary missions with long flight 
times,, simple velocity corrections, applied early in the mission 
will produce large changes at encounter. This fact merits mapping 
injection errors to encounter and then determining the early maneuver 
(nominally ten days post launch) required to null the effects of 
these errors. The FOM is. a measure of the cost of maneuver re- 
quired to null injection errors mapped to encounter rather than to 
maneuver time (midcourse correction time) . 

Whether IUS -injection accuracy is expressed in terms of FOM 
or IUS inherent capabilities, they both reflect the injection state 
errors. The. FOM computations or quantitative measures of the IUS 
inherent capabilities require, identification and analysis of the 
sources which contribute to the error~in the injection state. 

Listed below are the probable error sources : 

• Navigation. 

- IMU hardware. 

- Computational effects from navigation equations. 

• Guidance. 

Software errors representing off-nominal 

performance . 

* Guidance constants. 

* Quantization on cut-off prediction. 

* Targeting errors due to approximation 

in guidance equation. 
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Attitude control. 


- Transport delays. 

- Dead zones. 

Dynamic cross-coupling. 

• Third-stage spin dynamics^ 

Mass uncertainty. 

“ Inertia uncertainty. 

RCS thrust imbalance. 

Spin rate at which -active .control is terminated. 
Final spin rate uncertainty. 

Flexibility effects. 

• Second stage separation. 

• SRM^ burn. 

~ ■ I S p tolerance. 

Thrust misalignment. 

- Center of mass uncertainty ._ 

Rate of chance of moments of inertia— 

• Third stage. separation. 

^ P ^ ^ irnxr* ary dns Ivsis ox t ~ _ _ . - „ 

software) could be accomnlished bv L-ou— on^^S ana/cr 
encountered due to: * -/ ac-ou..— n s .or only tne errors 

• Initial IUS state dispersion (at deployment) . 

• I MU hardware . 

• Third stage dynamics and 3RM^ burn. 

An analysis of these errors w • 1 ' he 1 - 4 - — ; _ ... 

ments .or the software when superimposed"in%Re‘ ncm 
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B. 5 Analysis Tools 


The analysis of the third-stage dynamics is of utmost impor- 
tance at this time. This analysis should include the period 
beginning just prior to the start of the spin and ending with 
spacecraft separation (Figure B.l-3, terminal events). The 
mathematical model must have the inherent capability to imple- 
ment the actual control shemes that are proposed as the design 
evolves. The simulation of the mathematical model can be subdivided 
into three segments: 

• Thrusters firing with active control and thrusters 

firing. without active control. 

• Stage separations. 

• SRM 3 burn. 

ideal third-stage dynamics model should represent "general 
motion of. a spinning body with varying configuration and mass." 

This will describe a body under translation and rotation, with 
relative motion leading to varying configuration, undergoing 
changes in mass with time. 


There are two operational computer programs which can be used 
for preliminary analysis u. SAMBO and the Boeing Gamma-Guidance 
simulation. SAMBO utilizes, linear programming (Simplex Algorithm) 
to determine quasi optimum exoatmo spheric trajectory for multistage 
rockets in the earth's gravity, field. This, algorithm allows 

three degrees-of -freedom (Newton's equations of morion) for .the 

vehicle. SAMBO can provide an initial reference trajectory that 
achieves the missions planetary injection -constraints. The 
third-stage trajectory can also be ideally generated by SAMBO. 
However, it should be noted -that these reference trajectories 
generated by SAMBO are based upon optimization of certain cost 
functions. Thus, the validity of SAMBO-generated reference 
trajectories are dependent on the choice of the cost functions. 

The Boeing Gamma Guidance Simulation makes use of a state 
space formulation to solve a two-point' boundary value problem 
for the set of nonlinear ordinary differential equations that 
describe the IUS trajectory. The algorithm is an explicit 
guidance scheme that generates thrust steering angles for both 
SRM and RCS based, on the knowledge of the current state and the 
desired mission orbit conditions. Gamma Guidance solves for 
combinations of SRM and RCS control variables (steering ancles 
and ignition times) depending on the stage of the trajectorv to 
which the IUS has progressed. The simulation requires an initial 
guess of the control variables. Different constraint solutions 
exist for different control variable initial guesses. The initial 
values of the control variables could be obtained from SAMBO- 
generated trajectories for preliminary analysis, 
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Boeing's reference trajectories (nominal trajectories) and 
trajectory generator computer program will be essential for analysis 
and software testing. 
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PLANNING DOCUMENTATION AND SUPPORT SOFTWARE ANALYSIS 


&?I s ? ff ° rt inclUded oTfset^f UfSS 1 

0,1 Software T echnical Planning Analysis 

does n ot ^IS!r«aLrthroSa^ri OPment , E>Un (Raf — 25) 
development v*ere U>e Ti“n D§D/S?I and P S«t *° ? US software 

co^ Pe V eWntially ^ *f ^^ul?fne“sir rS S=Sld“e and 

speltl^f i“ an? a 'M=St 1 “ PaC:tS ° f phased development were nSt 
p ltiea ^ or an ^ ilj -ght or support software package. 

Recommendations for the plan fsee Reforonnn -> c\ . , 

d e t a iled r s chedul e s^and °a 6 we 11 S def in ed ° S ? ftware formal 

delld^^lSrShfi^ 3 ^^ nav f r ^--ti! U Se= t a 1 Se C ?L tr ^r Pl ^=e 

planning purposes and allowed^he docu^nt e to°l ly f ° r P Ee:liminar Y 

SS 5 ^ 1 

the flight and support softSS 

flvnl Another deficiency in the development plan was the lack of 
identified°their r baiic Ion^igiratiSn in9 ' B ° eing and TRW subsequently 

BSs&'ffisasatt'aa 

v>rry<JH° P £°3 ^ , management information in the MSFC So-*-var» 

?ro]ecuS Schedules and Status Report (Reference 27 ) Cite; r~ 

war^'^pdates U a = hedule h s ! ra ="“9 items Sportlit to N^^ft! 

information'fro^review p^sIn^i^^rioVnT *£%*?“ 

updates were provided quarterly throuahcmt- +*h* ^ schedules. Schedule 

28, 29, 30, and 31). * uarteri / throughout the contract (References 

t /b '" • 
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c * 2 Support Software Analysis 


fi irrh^ V =ifJ tl0n ° f the support software complements the -IUS 
1 0 f ^ 8 analysis by providing insight into all phases 

software production. Familiarity with the compiler 
formatting software facilitates understanding the 

taols , SfSSS.: t S e S r, .“ d the £ormat for the progra^ lold _ 
V&V Simulator St t f} <2 J nter P retive computer simulator (ICS) , 

heckout station _(COS) helps ensure that these 

ware deailn Pinallv^!^ VSr i fy 311 ficeu o£ the *Hght soft- 
C.2.1 MOS Data Formatting 


. . u Tb f f , sof tware will create a mission data load (mdl) tanp 

|£* p f led SS£ ZtlSt HimtT . 1 SJ’SJoSS-SVSUt. 

test -Boeing has already specified; and seoondly.amo^DositiSI 

i^d n OFS 1 tane°LJ»» eme T* g r °P osed to ensure -compatible MDL tape 
and OFS tape merges. A software identification cross-check waS 

suggested to replace the manual tape label verification The 

the launch window. Multiple software load tape deliveries dicSL* 

=0mPleX handlL ’ procedures^for* 183 

C.2.2 Test Support Software 

Simui^ U ii%i 973, Reference 3 noted deficiencies in the v&U 
^ software requirements. NASA requirements for third 

a H d t ^ ird stage command interface were not scheduled* 
and the simulator breakpoint/restart capability did not contain d ' 
a feature that would allow the operator to suspend a test lumS 
j-lignt computer memory, and resume testing, '’’hese deficieneip* 

JTJhTm?; w P RID ' S at thS V&V Simulator CDR? loeing-s ^nswe*- 
5® t {)® RI ? s was to incorporate full breakpoint/restart capabU?t«‘ 

^ bo defer the NASA requirements until more specific OFS P reau^a- 
ava * lable — Prior to the NASA PDR, Boeing should define” 

Us develoSant e T^e tS S |lerL=e V -?^ Ulat ° r Update and a 
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An analysis of the JOVIAL (J73)/M362S Cross Compiler in 
Reference 5 pointed out several restrictions on compiler design 
hat were not related to developing efficient software and there- 
rore were unproductive. Restrictions included percent of compiler 
source code m assembly language, memory limitations, and the 
number of -instructions per statement. These constraints remain 
in the currant compiler specification dated January 31, 1979. 

The review of COS software (Reference 32) revealed that 
T^f re u ar f n ° uni< ? ue NASA requirements -for this system. Under the 
IUS checkout concept, any^ NASAiunique. checkout procedures will be 
a part of the .test .scenarios written by test engineers and 
incorporated into the COS software- ~ 

Several software improvements were proposed for an ICS 
design proposed by. the IV&V contractor (see Reference 33) 
Recommendationa were included for performance improvement for 
interactive testing of the IUS flight software instead of complete 
on . b * tch processing. Another concern was that the ICS 
had. been originally proposed as the primary software test tool 
Subsequently, the IV&V contractor was authorized to procure a real- 
time. V&V Simulation facility with flight hardware (o? equivalent) 
from the Boeing Company. 

C, 2,3 MOS Post-processing Software 

The MOS Post-processing CPDS defines a good, general-purpose 
data processing package for analyzing IUS flight data. Our only 
comments, were that the software should be programmed in an AMSII 

^ gh “ Qrder language for transportability to other computers 
of an. IUS memory dump should present the contents 
rerer-nced to the specific memory address. 3AC had deleted the 
references to FORTRAN in the CPDS and is currently planning to 

J7 VI which is not an AMS 1 1 standard language. 
Therefore, a RID was submitted on the proposed language. BAC 
agreed to the memory-dump format suggestion. A summary o^ the 
MOS PDR discussions is presented in Reference 34. 

During the MOS PDR, the BAC presented an ICD for Mission 

Processin 9 Software Input Mission Data 
(ICS-290-80036) . ..his ICD. specifies the format for IUS data tapes 
delivered to BAC for post-processing. 
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